On Wednesday night, TV5Monde, a multi-station television network headquartered in Paris, France, saw 11 of its TV stations taken off the air for hours around the same time that it suffered an internal IT outage alongside a social media and website takeover. As of press time, the attack has left its broadcast capabilities hobbled.
The network's websites and Facebook page were defaced with pro-ISIS imagery and statements that recalled the January killing of staffers at French magazine Charlie Hebdo; those have since been removed, replaced by announcements blaming 'an Islamist group' for the disruption. Both the network's main site and Facebook page had been defaced with the phrase "I am IS" and a tag for the hacking group CyberCaliphate, which previously took credit for leaking confidential US military secrets in January and overtaking Newsweek's Twitter account in February.
No such messages or imagery were aired on TV5Monde's 11 affected stations; instead, they were fully blacked out for hours. No hacking group has since taken credit for the TV station blackout. Since regaining access to the signals, the network has only been able to air pre-recorded content, as opposed to any live broadcasts or updated content. The network's YouTube channel has been updated with a few videos confirming that social network and website content was taken down as soon as possible and that the company was working to restore full broadcast operations. That process could take "days" to complete.
"Une agression fulgurante"
Parisian newspaper Les Echos spoke to TV5Monde network IT director JP Vérines, who described "a single, coordinated attack" that looked to him to be a slight technical outage at first. Its severity became clear once the entire network's e-mail server went down. He described the outage as "a quick strike" ("une agression fulgurante") that had probably been in the works "for weeks," and he confirmed that France's ANSSI was involved in an ongoing investigation.
Vérines said it was "still too early" to determine the exact cause of the hack, but he confirmed that the company had been warned two weeks prior by ANSSI about unauthorized access to one of the network's servers. The Les Echos report attributed one guess about the hack to Check Point Software Technical Director Thierry Karsenti, who believed hackers may have gained control by way of malware injected to the system through either a USB flash drive or a clicked e-mail link. At that point, according to Karsenti, the attackers could "map" the company to target "key people in the IT infrastructure."
While media outlets have been frequently targeted by the hacking world, those attacks have typically taken down or wrested control from websites and social media feeds, whether by using brute DDOS force or figuring out account passwords. A takedown of many TV stations at once, conversely, is otherwise unprecedented. French officials have since made statements about bolstering the security of the country's largest media outlets and confirmed that a "terrorism investigation" has been opened.
Additional reporting by Megan Geuss.
reader comments
47